\(k\) NN is a non-parametric learner.
As such, we consider a score function for the attacker based on the number of prescibed points \(\mathcal {A}\)  classifies according to the attacker's wishes. This measure of the effectiveness of an attack is in contrast to most previous work on training-time attacks against parametric learners, where the effectiveness is defined in terms of a distance between (learned and target) models ([1]}).
We consider an attacker aiming to control the predicted labels of a set of points important to them.
For example they may have a collection of emails that she would like classified as ham.
They accomplish their task by constructing examples and inserting them into the training set.
We formalize this threat model as follows.
